Hunt List
12,950 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-12341 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | This vulnerability impacts all versions of IdentityIQ and allows an unauthentica | |
|
80
|
CVE-2026-62003 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | |
|
80
|
CVE-2026-62004 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | |
|
80
|
CVE-2026-62005 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | |
|
80
|
CVE-2026-62010 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | |
|
80
|
CVE-2026-62011 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | |
|
80
|
CVE-2026-62015 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | |
|
80
|
CVE-2026-62016 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | |
|
78
|
CVE-2026-46892 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product | |
|
78
|
CVE-2026-91490 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion | |
|
78
|
CVE-2026-70456 |
8.8 | 0.0040 | NET NO AUTH LOW CX NO UI | rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the re | |
|
78
|
CVE-2026-70458 |
8.8 | 0.0040 | NET NO AUTH LOW CX NO UI | rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allo | |
|
77
|
CVE-2026-73500 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | etcd is a distributed key-value store for the data of a distributed system. Prio | |
|
77
|
CVE-2026-111733 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read | |
|
77
|
CVE-2026-111736 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when | |
|
77
|
CVE-2026-115793 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | P-Net before 1.0.3 does not release the RPC session allocated for an RPC request | |
|
77
|
CVE-2026-62333 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | OpenVM is a performant and modular zkVM framework built for customization and ex | |
|
77
|
CVE-2026-91217 |
8.6 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
77
|
CVE-2026-41927 |
8.3 | 0.0040 | NET NO AUTH LOW CX NO UI | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains a stack-based bu | |
|
76
|
CVE-2026-42268 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | ModSecurity is an open source, cross platform web application firewall (WAF) eng | |
|
76
|
CVE-2026-116539 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnera | |
|
76
|
CVE-2026-72753 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | When Routinator encounters an RRDP notification file with gaps in the delta entr | |
|
76
|
CVE-2026-42272 |
7.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serv | |
|
75
|
CVE-2026-28944 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in Sa | |
|
75
|
CVE-2026-28962 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | This issue was addressed with improved access restrictions. This issue is fixed | |
|
75
|
CVE-2026-8609 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | An unauthenticated attacker can repeatedly call Grafana's OAuth login route with | |
|
75
|
CVE-2026-72754 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | When Routinator encounters a CRL with many entries, it may hang or run out of me | |
|
75
|
CVE-2026-72756 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Routinator exits when an rsync URI for a file obtained over RRDP contains a path | |
|
75
|
CVE-2026-72758 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | When parsing an AS range in Routinator, if the maximum value of the range is sma | |
|
75
|
CVE-2026-5086 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing att | |
|
75
|
CVE-2026-58421 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service | |
|
75
|
CVE-2026-118650 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middle | |
|
75
|
CVE-2026-101421 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
75
|
CVE-2026-91237 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
68
|
CVE-2026-72537 |
8.8 | 0.0040 | NET LOW CX NO UI | A privilege escalation vulnerability in Authentik Security authentik through 202 | |
|
67
|
CVE-2026-12070 |
8.4 | 0.0040 | NET LOW CX NO UI | Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file del | |
|
67
|
CVE-2026-111638 |
8.3 | 0.0040 | NET LOW CX NO UI | sshportal through 1.19.5 contains a missing authorization vulnerability in the m | |
|
67
|
CVE-2026-62195 |
8.7 | 0.0040 | NET LOW CX NO UI | OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vuln | |
|
67
|
CVE-2026-64631 |
8.6 | 0.0040 | NET LOW CX NO UI | A vulnerability allowing a low-privileged user to inject SQL and extract databas | |
|
66
|
CVE-2026-56670 |
8.2 | 0.0040 | NET NO AUTH LOW CX | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes int | |
|
66
|
CVE-2026-56672 |
8.2 | 0.0040 | NET NO AUTH LOW CX | ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, | |
|
66
|
CVE-2026-65570 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versio | |
|
65
|
CVE-2026-35587 |
7.3 | 0.0040 | NET LOW CX NO UI | Glances is an open-source system cross-platform monitoring tool. Prior to versio | |
|
64
|
CVE-2026-54312 |
7.2 | 0.0040 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 2.24.0, an authenti | |
|
64
|
CVE-2026-53795 |
7.2 | 0.0040 | NET NO AUTH LOW CX | rsync before 3.5.0 contains an arbitrary file write vulnerability that allows at | |
|
64
|
CVE-2023-7332 |
7.1 | 0.0040 | NET LOW CX NO UI | PocketMine-MP versions prior to 4.18.1 contain an improper input validation vuln | |
|
64
|
CVE-2026-64833 |
7.1 | 0.0040 | NET NO AUTH LOW CX | FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability | |
|
59
|
CVE-2026-27101 |
7.2 | 0.0040 | NET LOW CX NO UI | Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application version(s) 5.28. | |
|
56
|
CVE-2026-71445 |
8.2 | 0.0040 | NET LOW CX | AIL Framework contained a reflected cross-site scripting vulnerability in the /t | |
|
55
|
CVE-2026-53958 |
7.6 | 0.0040 | NET LOW CX | 4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4g |